Buggy code:
@ Controller public class AjaxController { private Object session ; DocumentModel document = new DocumentModel ( ) ; SectionModel section = new SectionModel ( ) ; @ RequestMapping ( value = { "//getDocuments//" , "//getDocuments" } , method = RequestMethod . GET ) @ ResponseBody public ResponseEntity < String > getDocuments ( HttpServletRequest request , HttpServletResponse response ) throws Exception { request . setCharacterEncoding ( "UTF-8" ) ; List < DocumentModel > documentList = new LinkedList < > ( ) ; documentList = document . getDocumentRow ( request . getParameter ( "id" ) ) ; String html = "<table<seq2seq4repair_space>id=\"docInfoTable\"<seq2seq4repair_space>style=\"width:100%;<seq2seq4repair_space>\">\n" + ( ( ( ( ( ( ( "<seq2seq4repair_space><thead>" + "<tr>\n" ) + "<seq2seq4repair_space><td>#<//td>\n" ) + "<seq2seq4repair_space><td>Title<//td>\t\t\n" ) + "<seq2seq4repair_space><td>Section<//td>\t\n" ) + "<seq2seq4repair_space><td>Date<//td>\n" ) + "<seq2seq4repair_space><//tr>\n" ) + "<//thead><tbody>" ) ; for ( DocumentModel tempDocs : documentList ) { String clas = "" ; if ( ( tempDocs . valid ) == 0 ) { clas = "inValidDoc" ; } <START_BUG> if ( tempDocs . access . contains ( request . getParameter ( "userId" ) ) ) { <END_BUG> if ( ( tempDocs . isDelete ) != 1 ) { html = ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( ( html + "<tr<seq2seq4repair_space>id=\"tableTr" ) + ( tempDocs . id ) ) + "\"<seq2seq4repair_space>class=\"documentsTable<seq2seq4repair_space>" ) + clas ) + "<seq2seq4repair_space>display\">\n" ) + "<td><a<seq2seq4repair_space>target='_blank'<seq2seq4repair_space>download<seq2seq4repair_space>href='" ) + ( Constants . URL ) ) + ( tempDocs . path ) ) + "'>" ) + ( tempDocs . clientId ) ) + "<//a><//td>\n" ) + "<td<seq2seq4repair_space>onclick=\'showDocument(\"" ) + ( tempDocs . path ) ) + "\",\"" ) + ( tempDocs . id ) ) + "\")\'>" ) + ( tempDocs . title ) ) + "<//td>\n" ) + "<td<seq2seq4repair_space>onclick=\'showDocument(\"" ) + ( tempDocs . path ) ) + "," ) + ( tempDocs . id ) ) + "\")\'>" ) + ( tempDocs . parentName ) ) + "<//td>\n" ) + "<td<seq2seq4repair_space>onclick=\'showDocument(\"" ) + ( tempDocs . path ) ) + "," ) + ( tempDocs . id ) ) + "\")\'>" ) + ( tempDocs . date ) ) + "<//td>\n" ) + "<//tr>\n" ; } } } html = html + "<//tbody><//table>" ; DB . closeCon ( ) ; response . setCharacterEncoding ( "UTF-8" ) ; HttpHeaders responseHeaders = new HttpHeaders ( ) ; responseHeaders . add ( "Content-Type" , "application//json;<seq2seq4repair_space>charset=utf-8" ) ; return new ResponseEntity ( html , responseHeaders , HttpStatus . CREATED ) ; } @ RequestMapping ( value = { "//makeBreadcrumbs//" , "//makeBreadcrumbs" } , method = RequestMethod . GET ) @ ResponseBody public ResponseEntity < String > makeBreadcrumbs ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } @ RequestMapping ( value = { "//checkLoginPass//" , "//checkLoginPass" } , method = RequestMethod . GET ) @ ResponseBody public String checkLoginPass ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } @ RequestMapping ( value = { "//deleteUser//" , "//deleteUser" } , method = RequestMethod . GET ) @ ResponseBody public String deleteUser ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } @ RequestMapping ( value = { "//deleteDoc//" , "//deleteDoc" } , method = RequestMethod . GET ) @ ResponseBody public String deleteDoc ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } @ RequestMapping ( value = { "//isValidDocument//" , "//isValidDocument" } , method = RequestMethod . GET ) @ ResponseBody public String isValidDocument ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } @ RequestMapping ( value = { "//checkUsername//" , "//checkUsername" } , method = RequestMethod . GET ) @ ResponseBody public String checkUsername ( HttpServletRequest request , HttpServletResponse response ) throws Exception { } }

Fix:
if ( ( tempDocs . access . contains ( request . getParameter ( "userId" ) ) ) || ( ( request . getParameter ( "userRole" ) ) != "0" ) ) {